ci: Pin Maven to 3.9.16 for builds

[claude]

Requested by Kiel Frost · Slack thread

Before: Pre-release publishes have failed Maven Central validation since 2026-10-07. That matches the move of ubuntu-latest from Maven 3.9.16 to 3.10.0 in runner image 20261004.327.1. The same commit, 20f555f, validated at 2026-10-07 05:32 UTC and has failed every nightly run since. #81 reverts all the 10-07 dependency changes, back to the last known-good tree, and it still fails. Every failing bundle is about 1.2 KB larger than the passing bundles built from the same source.

After: The build downloads Maven 3.9.16 and checks its SHA-512 instead of using the runner image's Maven. It also logs mvn -v. If this PR's pre-release publish validates, that confirms the cause.

How: A new Setup Maven step in .github/actions/build-test-pack-deploy/action.yml fetches the Apache Maven 3.9.16 binary from archive.apache.org and checks its SHA-512. It then puts the binary first on PATH, ahead of the rest of the build. CI, PR and release builds all use this composite action, so they all get the pinned version. The alternative or follow-up is to bump central-publishing-maven-plugin from 0.8.0 to 0.12.0 (released 2026-10-13), which may handle Maven 3.10, and then drop this pin.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y7YD8x9feha2ydTUBbQyBv

---

Generated by Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}